Privacy Policy

1. Data controller

Atlas Life Sciences GmbH

Aroser Allee 68, 13407 Berlin

Email: clinical@atlasbiolabs.com (privacy matters)

2. Definitions

This policy uses the terms defined in Article 4 GDPR (including 'personal data', 'processing', 'controller', 'processor', 'consent', 'data subject'). Where this policy refers to 'we', 'us', or 'our', it refers to Atlas Life Sciences GmbH as the data controller.

3. Data processing on website visits

When you visit protocol.atlasbiolabs.com, our servers automatically record standard access data: IP address, browser type and version, operating system, referrer URL, and the time of access.

Log files are stored for 7 days and then automatically deleted.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in secure operation of the website.

Origin of an order: if you reach us through a campaign, an ad or a link on another website, we keep the campaign details of the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the referring domain and the landing page in the memory of the open page; only a campaign page (such as /baseline) counts as the landing page, never the page about an individual test. On your first visit we also assign a random visit ID (acq_id) that is not derived from anything you enter. None of this is stored on your device: no cookie and no other storage; the memory of the page ends when you reload or close it. When you open a page and when you click the order button, our servers report the visit ID together with the campaign details, the landing page, the referring domain and the country derived from your IP address (the country only, no region and no city; we do not pass on the IP address itself) to Atlas OS (app.atlasbiolabs.com, also Atlas Life Sciences GmbH). If you place an order, the same details go with the order to the Atlas OS checkout; there, the campaign details and the visit ID are stored with the order, and the visit ID also as a reference on the payment at Stripe. If the link carried the click ID of an advertising platform (oppref, gclid, gbraid, wbraid, msclkid, fbclid, twclid, li_fat_id), only the platform it belongs to is stored with the order, not the ID itself. We pass none of this on to advertising platforms. This lets us evaluate which campaign led to an order. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in evaluating the success of our campaigns; you can object at any time (Art. 21 GDPR). Retention in Atlas OS: the country, referring domain and landing page are deleted 90 days after the last contact, a visit without an order is deleted entirely 180 days after the last contact, a visit with an order 25 months after it. Details are in the Atlas OS privacy policy (app.atlasbiolabs.com/datenschutz).

4. Reach measurement with Vercel Web Analytics

We measure the reach of this website with Vercel Web Analytics, a service of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, which processes the data on our behalf (Art. 28 GDPR) and is certified under the EU-U.S. Data Privacy Framework. The measurement runs on every page, without a consent banner.

What is recorded: the page you visit (identifiers in the path or the query are removed in your browser before anything is sent; of the query only the campaign parameters, the language choice lang and the code of a referring partner practice ref remain; click identifiers of ad platforms such as gclid or fbclid never reach Vercel), the referring website, the campaign parameters of the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), your country, device type, operating system and browser, and the steps of an order (click on an order button, checkout opened, order submitted, payment completed), each only with the key of the product, such as atlas-baseline or trace, never with your name, your email address, an order number or the amount. Vercel Speed Insights additionally records how fast the page loads, with the same removal of identifiers.

No cookies, nothing on your device: the measurement neither stores information on your device nor reads it from there; Section 25 TDDDG does not apply. Vercel tells visitors apart only by a hash computed from the request data that changes every day and is discarded after 24 hours. There is no tracking across websites or devices and nothing is passed on to advertising platforms. Pages of our internal areas (/admin, /lab) are not measured.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to understand the reach and effect of our own campaigns and to improve our offer.

Right to object (Art. 21 GDPR): you can object to the measurement at any time. Technically, through the “Global Privacy Control” or “Do Not Track” signal of your browser (Art. 21(5) GDPR): if your browser sends it, this website sends nothing to Vercel. Or informally by email to clinical@atlasbiolabs.com.

Apart from this, this website stores something on your device only where a function you use needs it (Section 25(2) no. 2 TDDDG): your choice of language and display, a plan or cart you put together, the progress of an order or of the console in the open tab, and a session cookie for the checkout (atlas_kasse_sid, 48 hours). None of this serves measurement or advertising; we use no advertising tags.

5. Customer data (order processing)

When you place an order, we process: name, email, shipping address, date of birth, and payment information (payment information is processed by Stripe and not stored on our systems).

Purposes: order fulfillment, customer communication, legal compliance.

Legal basis: Art. 6(1)(b) GDPR — contract performance.

Retention: customer data 3 years after the last transaction; tax-relevant order data 10 years per HGB/AO.

6. Genetic and biological data (special category per Art. 9 GDPR)

Atlas Protocol processes genetic data (Atlas Baseline) and biological methylation data (Atlas Trace). This constitutes special category personal data under Art. 9 GDPR.

Legal basis: Art. 9(2)(a) GDPR — explicit consent of the data subject (collected at checkout).

Storage: samples and the genetic data derived from them are processed and stored exclusively within the European Union.

Access is restricted to authorized laboratory and clinical staff only. We do not sell genetic data to third parties. We do not share genetic data with insurance companies or employers; such sharing is prohibited under §4 GenDG and general privacy principles.

Retention: we keep sample material from Atlas Baseline and the DNA extracted from it until the 27th day after data delivery and destroy it afterwards; storage booked by then extends retention until the storage ends. Otherwise, samples and derived data are retained for as long as no deletion or destruction is requested. Customers may request the destruction of the sample and the deletion of the data at any time at service@atlasbiolabs.com. Deletion extends to commissioned laboratories and service providers.

Order and invoice data that must be retained under commercial and tax law remains unaffected; it contains no genetic data.

Right to withdraw consent: customers may withdraw consent at any time, triggering destruction of stored samples and erasure of raw genetic data.

7. Data processors and recipients

We engage the following processors and recipients to deliver the service:

• Stripe Payments Europe Ltd (payment processing, Ireland) — standard GDPR-compliant DPA in place.
• Vercel Inc. (hosting, reach measurement with Vercel Web Analytics and Speed Insights, US) — Standard Contractual Clauses and EU-U.S. Data Privacy Framework.
• Commissioned sequencing and partner laboratories within the EU — each bound by a data processing agreement pursuant to Art. 28 GDPR.
• A cooperating specialist in human genetics (counselling, consent under the GenDG, medical assessment and communication of results for add-on analyses), as an independent controller bound by medical confidentiality.
• Shipping service providers (DHL, DPD, GO Express) for sample and material shipment.

All processors are bound by data processing agreements per Art. 28 GDPR.

8. International data transfers

Where data is processed outside the EU (primarily Vercel in the United States), the transfer is safeguarded via Standard Contractual Clauses and the EU-U.S. Data Privacy Framework where applicable.

9. Data subject rights (Art. 15-22 GDPR)

You have the following rights regarding your personal data:

• Right to access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent (Art. 7(3))

Contact: clinical@atlasbiolabs.com

10. Right to lodge a complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority.

Supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Friedrichstraße 219, 10969 Berlin. https://www.datenschutz-berlin.de

11. Contact for privacy inquiries

For all privacy-related inquiries, please contact: clinical@atlasbiolabs.com.